From 7cc528e771dfaafed2362748b258336622e75253 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Fri, 18 Nov 2022 04:15:49 +0000 Subject: [PATCH 1/2] Adding tarfile member sanitization to extractall() --- get-gitzer.py | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/get-gitzer.py b/get-gitzer.py index ef3b59e..e0f1bd3 100755 --- a/get-gitzer.py +++ b/get-gitzer.py @@ -94,7 +94,26 @@ def install(self): colored_print("INFO", f"Installing Gitzer to {str(GITZER_PATH)}...") with tarfile.open(gitzer_tar, "r:gz") as tar_file: temporary_dir = self.gitzer_temp_directory() - tar_file.extractall(temporary_dir) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar_file, temporary_dir) os.makedirs(GITZER_HOME, exist_ok=True) shutil.move(temporary_dir / "build", GITZER_PATH) self.set_git_alias() From 1391b8a63339c5a98bcc0a621b2909c55bc23c6a Mon Sep 17 00:00:00 2001 From: Sourcery AI <> Date: Fri, 18 Nov 2022 04:15:59 +0000 Subject: [PATCH 2/2] 'Refactored by Sourcery' --- get-gitzer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/get-gitzer.py b/get-gitzer.py index e0f1bd3..287c054 100755 --- a/get-gitzer.py +++ b/get-gitzer.py @@ -53,7 +53,7 @@ def get_download_url(self): with closing(urlopen(request)) as response: data = json.loads(response.read()) tag_name = data["tag_name"].lstrip("v") - gzip_name = "gitzer-{}.tar.gz".format(tag_name) + gzip_name = f"gitzer-{tag_name}.tar.gz" assets = data["assets"] for asset in assets: if asset["name"] == gzip_name: @@ -65,7 +65,7 @@ def download_release(self): r = urlopen(gzip_url) except HTTPError as e: if e.code == 404: - raise RuntimeError("Could not find {} file".format(gzip_name)) + raise RuntimeError(f"Could not find {gzip_name} file") meta = r.info() size = int(meta["Content-Length"])